bk (Ben Koehl)

Threat Intelligence at @Microsoft Threat Intelligence Center (MSTIC).

[bk (Ben Koehl) @bkMSFT]

#attributionmatters

[State of Statecraft Conference @what_is_sos]

State of Statecraft (SOS) is a new security and intelligence conference purposed to bring together observers of espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored ops.

[Ramin Nafisi @MalwareRE]

Do you find analyzing Rust binaries/malware tedious and unpleasant? You’re not alone! If you’re attending #REcon this year, our own @hackingump1 will be unveiling #RIFT today at 2PM EST (not at REcon? We got you covered, stay tuned). We have been using RIFT internally for some time and it has truly transformed the way we handle and analyze Rust binaries.

https://t.co/RjyW093DUS

#RIFT #Rust #REon25 #MSTIC #MIRAGE

[bk (Ben Koehl) @bkMSFT]

@cyb3rops @JohnLaTwC Still true

[John Lambert @JohnLaTwC]

3. Your network is a directed graph of credentials. Hacking is graph traversal. See the graph or all you'll see is exfil.

[bk (Ben Koehl) @bkMSFT]

@cyb3rops Wise words from @JohnLaTwC from 2017 on this topic: https://t.co/jBXElI6WTO

[FBI @FBI]

In 2024, FBI and our partners raised the alarm about China’s hacking of US telecommunications infrastructure. This year, we’re going after the individuals responsible for the intrusions. If you have information about Salt Typhoon, we want to hear from you: https://t.co/GhNwhUwg2P
______________________________

2024年，联邦调查局与我们的伙伴针对中国黑客入侵美国电信系统的行动发出警示。今年，我们计划将从事入侵行动的人员绳之以法。如果您有任何关于盐台风的信息，我们希望您跟我们联系: https://t.co/BTKRBz5xmW

[John Lambert @JohnLaTwC]

Come help me create mechanical advantage in defense.

If you love threat hunting, learning from incidents, building new ways to find attackers, and empowering others, this may be the perfect job for you.

Help expand defense from the relational world of hunting to graphs, anomalies, embeddings, and beyond.

This is a hands on role. You will be hunting, creating, and applying. You will be using your ideas on current incidents helping us gain speed on attackers.

Due to the collaborative nature of the work, I am only considering US working hours/time zone for this position.

#msftsecurity #jobs #security #securityresearch

Principal Security Researcher
Redmond, Washington, United States

➡️https://t.co/IfoL2SKMu2

[HITCON @HacksInTaiwan]

SINCON 2025 is coming! 🚀 As a proud partner of HITCON, we invite you to explore cutting-edge cybersecurity at SINCON 2025!

📅 22-23 May 2025 | 📍 voco Orchard, SG
💡 Use “SINCON25-SUPPORTER” for S$100 off!
🔗https://t.co/4wtxtDlSoM

[bk (Ben Koehl) @bkMSFT]

. @JohnHultquist we need more #cyberwarcon

[bk (Ben Koehl) @bkMSFT]

@CYBERWARCON time for a two-day conference?

[bk (Ben Koehl) @bkMSFT]

Come work with me and the team! We have a large global team focused on extremely interesting work with a large opportunity to have impact.

Principal Security Researcher (US)
https://t.co/SmZ7rqdCyn

Do you enjoy security research?

[Nick Carr @ItsReallyNick]

I'm told we are hiring in MSTIC: https://t.co/ltfZcQbg5n
Come for the data, stay for the data. Creative problem solvers have the most impact.
If we've worked together, I'm happy to refer you.

But...

[bk (Ben Koehl) @bkMSFT]

When in Taipei….

Enjoy a good cocktail and shellcode at https://t.co/vVOgxRctp8

[CYBERWARCON @CYBERWARCON]

🚨 Speaker Spotlight 🚨

Join us at #CYBERWARCON to hear from James Elliott, a seasoned expert with 25+ years of experience! Currently at MSTIC, James has built threat intel teams for the DoD and private sector.

🎟️ Don't miss out! Get your tickets now: https://t.co/12b29mbC52

[bk (Ben Koehl) @bkMSFT]

Cyber intel reunion / epic conference 2024 👇

[CYBERWARCON @CYBERWARCON]

CYBERWARCON is coming!!! Registration and CFP are now open for this year’s #CYBERWARCON! This year’s keynote will be given by the NSA’s @adamski_morgan. The in-person event is in Arlington, VA on Nov. 22nd and virtual tickets are available. 1/x https://t.co/MTEL4utvgM

[Austin Baker @BakedSec]

It simplifies the process of keeping analyst work and notes in a structured and queryable format AND allows that work to be reflected to analysts perusing the same data as soon as it's recorded. Tag, bag, comment, feed to automation - whatever your needs are.

[billy leonard @billyleonard]

🆕🚨 analysis from @Google on APT42 activity against 🇺🇸 and 🇮🇱. A ton of work from folks over the past few months dedicated to protecting users disrupting campaigns, and making life hard for the actors. More to come!

https://t.co/rFocbBqXXv

[__mat__ @matthieu_faou]

We are looking for a strategic threat intel analyst to join @ESETresearch. Interested in cyber-espionage and geopolitics? Apply!
https://t.co/6I2tK39tsv

[bk (Ben Koehl) @bkMSFT]

Back then, that was definitely one of the most interesting courses of actions I had seen. Some countries would write blogs, work with others to out the activity, maybe name the specific actors, arrest people, etc. I believe there was also an official tweet that covered this.

Maybe an act of demonstrating escalation dominance?

I think the actor at the time was either “benny” or “ Adam Swift“?

[CYBERWARCON @CYBERWARCON]

🗓️ SAVE THE DATE: 11.22.24

#CYBERWARCON is a one-day conference focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities.

⚡ For CFP updates, sign up to subscribe on our website: https://t.co/12b29mbC52!

[bk (Ben Koehl) @bkMSFT]

@wxs @billyleonard There can only be one emoji king and it’s @billyleonard

[bk (Ben Koehl) @bkMSFT]

Persistent: Gingham Typhoon has continuously targeted Australia for years. They also ebb and flow to different countries in the region as strategically important issues drive collection efforts. You may run into activity Raspberry Typhoon during the same investigations as both appear to have a small overlap in targeting.

https://t.co/2SMGzqw6Xu

👏to @ASDGovAu for releasing information on their activity.